What the SDKs capture
- Failures: crashes, ANRs, JavaScript errors and handled exceptions, with the exception type and stack trace.
- Network metadata: method, host, path, status code, request and response sizes, timing, and a small set of safe headers.
- Device and app context: on Android: OS version, device model and manufacturer, locale, screen, and your app's package and version. On the web: user agent, locale, screen and viewport size, the page path, the referrer (origin and path only), and the
releaseyou set. - Identity: an anonymous install ID, plus your user ID if you call
identify. - Presence: a heartbeat while the app or tab is in the foreground.
What's redacted or never collected
These rules are applied on the device and can't be turned off:
| Data | Android | Web |
|---|---|---|
| Request and response bodies | Never captured | Never captured |
| URL query strings and fragments | Dropped (host and path only) | Dropped (host and path only) |
| Authorization, Cookie and other credential headers | Never captured | Never captured |
| Other headers | Only content-type, content-length, content-encoding, accept, cache-control | Only content-type, content-length, content-encoding, accept, cache-control |
| Exception messages | Replaced with [REDACTED] (opt in with captureExceptionMessages) | Replaced with [REDACTED] |
| Exception type and stack trace | Captured | Captured |
| identify() traits | Sent with product analytics (Growth+); email- and phone-like values masked | Sent with product analytics (Growth+); email- and phone-like values masked |
| Event properties (track, screen) | Sent; email- and phone-like values masked; nested objects dropped | Sent; email- and phone-like values masked; page names are paths only |
| recordException() attributes | Not sent | Not sent |
Android config fields that don't change this
Android'sCodeskopConfig has captureBodies, captureHeaders and redactQueryKeys fields. In 0.3.0 they have no effect: bodies are never captured and query strings are always dropped, whatever you set.Adding your own sensitive headers
Both SDKs accept a redactHeaders list. Because only the five headers above are ever read, this can only narrow what's captured, never widen it.
Your responsibilities
- Use an opaque user ID. Pass the ID from your database, not an email address, phone number or name.
- Keep personal data out of traits and properties. Traits passed to
identifyand properties ontrackare stored for product analytics. Use them for things like a plan name or a product id. Values that look like emails or phone numbers are masked. - Ship only the public key. Public keys (
cs_…_pk_…) can only write events. Secret keys must never be in an app; both SDKs refuse them. - Respect opt-outs. If a user declines diagnostics, don't initialize the SDK. On the web you can also pause capture with
setEnabled(false).
Security
Keys
Your app only ever holds a write-only public key. It can't be used to read your data, so it's safe inside an APK or a JavaScript bundle. If a key is abused, it can be revoked and replaced.
Transport
Events are sent to Codeskop over HTTPS, compressed, in batches.
Your app's stability
The SDKs are built so they can't take your app down: public methods never throw, work happens off the main thread, and the on-device queue has a fixed size cap. Codeskop can also switch capture off remotely if something goes wrong.
Open source
The web SDK is MIT-licensed and published on npm, so you can read exactly what it does before you ship it. Questions about data handling? Contact us.